guardian: isolate review context from skills and memories

[jif-oai]

Why

Guardian reviews embed the parent session transcript as untrusted evidence. Skill or plugin mentions in that transcript must not be interpreted as requests to inject more instructions into the Guardian request, and memory context adds unrelated model-visible context to an approval decision.

Keeping those sources out of the nested review session makes the request smaller and preserves the trust boundary around the transcript being assessed.

What changed

• Skip skill and plugin discovery when building turns for Guardian reviewer sessions.
• Disable memory context and dedicated memory tools in the derived Guardian configuration.
• Extend the Guardian request-layout coverage to verify that a $skill mention remains visible only as transcript evidence while neither the skill body nor memory context is injected.
• Expand the Guardian configuration test to cover the disabled memory settings.

Testing

• Updated the Guardian review request snapshot and assertions for skill and memory isolation.
• Extended the Guardian session configuration test to cover memories.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4640faa650

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".